Is there a patch available for CVE-2026-13148?

Yes, a patch is available for CVE-2026-13148. Update the affected software to the latest version immediately.

smartLink HW-PN CVE-2026-13148

Q: What is the CVSS score of CVE-2026-13148?

CVE-2026-13148 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:L/U:Red. EPSS exploitation probability: 0.4%.

EUVD-2026-70986 MEDIUM

Memory Leak (CWE-401)

2026-09-04 Softing

GHSA-5mwp-xgjv-pjph

Smartlink Hw Pn Softing

6.3

CVSS 4.0 · Vendor: Softing

Severity by source

Vendor (Softing) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:L/U:Red

vuln.today AI

8.5 HIGH

Network-reachable with low privileges; scope change captures downstream PROFINET device integrity impact; no confidentiality loss; low availability degradation on subsequent systems.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:L

Primary rating from Vendor (Softing).

CVSS VectorVendor: Softing

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Sep 04, 2026 - 11:02 EUVD

Metadata Corrected

Sep 04, 2026 - 10:40 vuln.today

tag: Information Disclosure removed

Analysis Generated

Sep 04, 2026 - 10:25 vuln.today

DescriptionCVE.org

Missing release of memory after effective lifetime vulnerability in Softing smartLink allows resource leak exposure.

This issue affects smartLink HW-PN: from 1.04 before 1.10.

AnalysisAI

Uncontrolled memory growth in Softing smartLink HW-PN versions 1.04 through 1.09 allows a low-privileged network-adjacent attacker to trigger a resource leak that propagates high-integrity and low-availability impact to downstream subsequent systems - likely PROFINET-connected industrial devices bridged through the gateway. The vulnerability is classified CWE-401 (Missing Release of Memory after Effective Lifetime), indicating that allocated memory is not freed upon session or object expiration, accumulating over time. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a low-privilege authenticated account on the smartLink HW-PN network interface - the CVSS vector PR:L confirms authentication is necessary. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 base score of 6.3 reflects a moderate-severity finding whose real-world impact is concentrated in operational technology environments rather than enterprise IT. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade smartLink HW-PN firmware to version 1.10 or later, as the vendor's advisory (https://industrial.softing.com/fileadmin/psirt/downloads/2026/CVE-2026-13148.html) defines 1.10 as the remediated release boundary. … Detailed patch versions, workarounds, and compensating controls in full report.